Skip to content
Beyond™

Beyond™ Scanner

We watch the threats. You get the answer.

The scanner checks your website from the outside, matches what it finds against the threats doing the rounds right now, and tells you in plain English what to fix first. Free, and it keeps itself up to date.

How healthy is your website?
Speed, HTTPS, security headers, titles, descriptions, phone layout and images, in one pass.

We keep the address and the result under a job code, so we can pick it up if you talk to us.

The verdict lands here
Check my site and the result appears with a job code you can quote.

How it works

Four steps, a few seconds each. What you paste is not kept; website checks are filed under a job code so we can follow up.

1. You give us an address

Your website, a link someone sent you, or a dodgy email. Nothing to install and no login.

2. We look from the outside

The same view an attacker gets: HTTPS, security headers, how fast it answers, and what the server gives away about itself, such as the PHP version.

3. We match it against live threats

The advisories we act on, CISA's list of flaws being used in attacks right now (checked every hour), and the Beyond block list built from scam emails people report to us.

4. You get a plain answer

Good, worth a look, or fix it now, with the reasons. Website checks get a job code so a real person can pick it up with you.

Threats we have acted on

What we know, and what we did

PHP2ShellCVE-2026-109618CVE-2026-109619
Made public 21/10/2026

What it is

Two flaws in PHP itself, the language under WordPress and much of the web. A single request with no login can take over a web server before the site's own code runs. Found by researchers at Wiz and Calif using AI; attacks went into the millions within hours.

The fix

Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or your host's patched package. Updating WordPress or plugins does not fix it.

What Beyond did

Checked 22/10/2026: no Beyond site or app runs PHP. The six source addresses Amazon published are blocked, and the website check flags PHP versions without the fix.

Blocked attacker addresses

  • 103.216.220.92
  • 31.223.184.166
  • 37.19.200.5
  • 134.209.159.64
  • 103.114.163.188
  • 95.217.98.37

These are shared anonymiser exits, so someone innocent may use one too. Block them, and patch anyway: the attack does not need these addresses.

Sources: BBC News, Help Net Security, Amazon Threat Intelligence

Live feed

Being used in attacks right now

The newest entries in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue, checked every hour. Anything that touches software we or most small business websites run is marked, and we patch those first.

CVE-2026-96656Plex Media ServerAdded 20/10/2026

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

CVE-2026-96655Plex Media ServerAdded 20/10/2026

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

CVE-2026-96654Plex Media ServerAdded 20/10/2026

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

CVE-2026-96652Plex Media ServerAdded 20/10/2026

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

CVE-2026-110936Siemens Software CenterAdded 20/10/2026

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

CVE-2026-106931EG Secure Solutions SiteGuard Server EditionAdded 20/10/2026

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

CVE-2026-102764BeyondTrust Remote SupportAdded 16/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

CVE-2025-61624Fortinet Multiple ProductsCommon in NZ businessesAdded 16/10/2026

Fortinet Multiple Products Path Traversal Vulnerability

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

What happens to what we find

  • Block list

    Scam senders, domains and attacker addresses go on one list. Our checks flag them and our forms quietly drop them.

  • Firewalls

    Attack sources from credible published reports are blocked at the edge of Beyond's own sites, so they never reach the code.

  • Patching

    When a flaw touches software we or our clients run, we check every site, patch what needs it and say so here.

The scanner is a quick check, not an audit. If it flags something, or you are not sure who looks after your website, talk to us or ring 027 232 3232. For email scams, see Scam Shield.